1 Who we are
The TrustShop app is operated by CÔNG TY TNHH CÔNG NGHỆ TRUSTSHOP, a company registered in Vietnam with enterprise registration number 3502535389 and registered office at Số 145/3A1, đường Tiền Cảng, Phường Rạch Dừa, TP Hồ Chí Minh, Việt Nam (“TrustShop”, “we”, “us”).
You can reach us about anything in this policy at support@trustshop.io.
This policy applies to the TrustShop app and to this website. It does not apply to the Shopify platform itself, or to any merchant’s own store — those are governed by their own policies.
2 Merchants and shoppers: two different roles
Our role under data protection law depends on whose data it is.
| Whose data | Our role | What that means |
|---|---|---|
| Merchants You, your staff, your account and billing data |
Controller | We decide why and how this data is processed, and this policy governs it directly. |
| Shoppers Your customers’ reviews, media, e-mail addresses, order and survey data |
Processor | We process this on your instructions, on your behalf. You are the controller. Your own privacy policy governs your relationship with your customers. |
3 Information we collect
3.1 Information merchants provide
- Full name and e-mail address
- Company name, store domain and business details
- Account credentials, stored in encrypted form
- Billing information — note that card details are handled by Shopify, not by us
- Support correspondence, including anything you send us in a ticket or chat
- Your configuration: widget settings, e-mail templates, offer and reward rules
3.2 Shopper information processed on your behalf
When you use TrustShop, we process personal data about your customers on your instructions. Depending on which modules you enable, this may include:
- Reviews — name or display name, e-mail address, country, star rating, review text, uploaded photos and videos, verified-buyer status, and any reply you publish
- Orders — order identifiers, purchased products and variants, order value, fulfilment status and order dates, received from Shopify
- Review requests — e-mail delivery, open and click events, unsubscribe status, and any one-time passcode sent by e-mail or WhatsApp for identity verification
- Questions — shopper questions submitted on product pages and your answers
- Visual Social Proof — social media handles, captions and media from accounts you connect, and media taken from reviews
- Upsells — cart contents and offer interactions, including impressions and acceptances
- Referrals — advocate and referred-customer identifiers, referral links and codes, referred order values, reward status, and signals used for fraud checks
- Surveys — survey and NPS responses, and the order they relate to
3.3 Information collected automatically
- Device type, browser and operating system
- IP address and approximate location derived from it
- Usage logs, including pages viewed in the app, actions taken and timestamps
- Widget analytics on your storefront — impressions, opens and add-to-cart events, which we use to give you per-widget performance figures
- Error and diagnostic logs
3.4 Information from third-party integrations
When you authorise a connection, we receive data from that platform to the extent the connection requires — for example store identifiers, access tokens, product and order data from Shopify, or media and account metadata from a connected social account. We only request the scopes needed for the features you use, and you can disconnect an integration at any time from the app.
4 How we use information
- To provide, operate and maintain the Service and the modules you enable
- To create and manage your account and authenticate access
- To send review requests, reminders, thank-you messages and survey invitations to your customers on your behalf
- To render widgets on your storefront and produce the analytics behind them
- To issue and track referral rewards, discount codes and store credit you have configured
- To process billing and manage subscriptions through Shopify
- To provide support, including — with your permission and under access controls — viewing your account to diagnose an issue you have reported
- To detect, investigate and prevent fraud, abuse, spam and security incidents
- To produce aggregated, de-identified statistics that help us improve the Service
- To send you service and product communications, and marketing you can opt out of at any time
- To comply with legal obligations and enforce our Terms of Service
We do not sell or rent your personal information, and we do not sell shopper data.
5 Legal basis for processing (GDPR)
Where the GDPR applies, we rely on the following bases for merchant data:
- Contract — to provide the Service you have subscribed to and to bill for it
- Legitimate interests — to secure the Service, prevent fraud and abuse, understand how the Service is used and improve it, and to market to existing merchants, balanced against your rights
- Consent — for non-essential cookies and for marketing where consent is required; you can withdraw consent at any time
- Legal obligation — where we must retain or disclose data by law
For shopper data we act as processor, and the legal basis is determined by the merchant as controller. Merchants are responsible for having a lawful basis before putting shopper personal data into the Service or asking us to contact their customers.
7 AI processing
Some features use AI models to translate reviews, summarise them, draft replies or help a shopper write a review. Where you enable these features:
- the relevant content — such as review text — is sent to our AI sub-processor for processing and the result is returned to the Service;
- we instruct our AI provider not to use your content to train their models;
- AI output can be wrong or misleading. Anything published to your storefront remains your responsibility, and we recommend reviewing AI-generated replies before publishing them;
- AI features can be turned off in the app, in which case no content is sent for AI processing.
8 Data retention
We retain personal data only as long as necessary for the purposes it was collected for, to comply with legal obligations, to resolve disputes and to enforce our agreements.
- While your app is installed — reviews, media and related shopper data are retained so they can continue to be displayed on your storefront.
- After uninstall — we retain your store’s data for 90 days so you can reinstall without losing anything, then delete or anonymise it, unless a longer period is legally required.
- On request — we delete or anonymise data on a valid deletion request, subject to the exceptions in section 11.
- Logs and diagnostics — retained for 30 days.
- Billing and tax records — retained for the period required by applicable accounting and tax law.
- Aggregated, de-identified data — may be retained indefinitely, as it no longer identifies anyone.
9 Security
We maintain technical and organisational measures appropriate to the risk, including encryption of data in transit, encryption of credentials at rest, access controls with least-privilege principles, audit logging of administrative access, and regular review of our infrastructure.
Support access to a merchant account is restricted, logged and used only to resolve an issue you have raised.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a personal data breach affecting your data occurs, we will notify you and the relevant supervisory authority where required by law and without undue delay.
10 Your rights
Depending on where you live, you may have the right to:
- access the personal data we hold about you and receive a copy;
- have inaccurate data corrected;
- have your data deleted;
- restrict or object to processing, including profiling;
- receive your data in a portable, machine-readable format;
- withdraw consent at any time, without affecting processing already carried out;
- lodge a complaint with your local supervisory authority.
If you are in California, you additionally have the right to know what personal information is collected, used and disclosed, the right to delete it, the right to correct it, and the right not to be discriminated against for exercising these rights. We do not sell or share personal information as those terms are defined under the CCPA/CPRA.
To exercise any right, e-mail support@trustshop.io. We will respond within the period required by applicable law — normally one month under the GDPR and 45 days under the CCPA. We may need to verify your identity first. If your request concerns data we process on behalf of a merchant, we will refer you to that merchant and assist them in responding.
11 Shopify data requests
As a Shopify app, we implement Shopify’s mandatory privacy webhooks. When a merchant or a shopper submits a request through Shopify, we act on it automatically:
- Customer data request — we compile the personal data we hold about that shopper and provide it to the merchant, who passes it on.
- Customer redaction — we delete or anonymise that shopper’s personal data, including their reviews, media and survey responses.
- Shop redaction — after a store uninstalls the app, we delete or anonymise that store’s data in line with section 8.
We may retain data despite a deletion request where we are legally required to, or where it is necessary to establish, exercise or defend legal claims, or to detect and prevent fraud. In those cases we restrict the data rather than continuing to use it.
13 International data transfers
We operate from Vietnam and use providers located in other countries, so your information may be transferred to and processed outside your jurisdiction — including in countries that do not offer the same level of data protection as your own.
Where we transfer personal data out of the EEA, the UK or Switzerland, we rely on appropriate safeguards, including the European Commission’s Standard Contractual Clauses together with supplementary measures where needed. You can request a copy of the relevant safeguards by writing to support@trustshop.io.
14 Children’s privacy
The Service is intended for businesses and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it.
15 Changes to this policy
We may update this policy from time to time. We will revise the “last updated” date at the top of this page and, where changes are material, give notice in the app or by e-mail before they take effect. We encourage you to review this page periodically.
16 Contact us
For any privacy question, request or complaint — or to exercise any of the rights in section 10 — get in touch.
TrustShop — Privacy
We aim to acknowledge privacy requests within two business days.